OpenVPN for PfSense

First of all you need to have keys and certificates generated in order to configure the pfSense OpenVPN service;

1. Download and install the most recent software from http://openvpn.net/download.html
   If you plan to connect from a PC with Windows Vista you should get version 2.1 or newer.
2. Use the default options
   Start a command prompt with administrator-rights!
3. Change directory to c:\programfiles\openvpn\easy-rsa
4. run the “init-config.bat” file
5. Edit 'vars.bat' file.
   The following things need to be edited:
   set KEY_COUNTRY=MY
   set KEY_PROVINCE=na
   set KEY_CITY=KL
   set KEY_ORG=OffGamers
   set KEY_EMAIL=youremail@my.offgamers.com
   Save the file
6. Run “vars.bat”
7. Run “clean-all.bat”
8. Run “build-ca.bat“
   Then you are prompted for some different things; Leave them at default, except “Common Name” - put something like “Soekris”
9. Run “build-key-server.bat server“
   Again you are prompted; leave them on default except “Common Name” - use “server”
   Run build-dh.bat

Client

Now its time to generate keys and certificates for the client(s)

• Run “build-key.bat client1“
  Again you are prompted; leave them on default except “Common Name” - here you should put in “client1” (or whatever you have called it)
  The client1 will be the name of the keys, certificate and the name you identify the connection on later. You can use whatever name you like, and generate as many as you want (with different names).
• The following files should now be copied from c:\Program Files\openvpn\ to c:\Program Files\openvpn\config
  easy-rsa\keys\ca.crt
  client1.key
  client1.crt
  (if you dont see a .crt file but only a .csr file, chances are that you dont have admin priviligies. Worst case generate the keys and certificates on a NON-Vista machine)
• Make a file in the c:\Program Files\openvpn\config called “client1.ovpn” and the file should contain

client
dev tun
proto udp
remote 203.223.138.226
ping 10
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
comp-lzo
pull
verb 3

• Put your soekris public IP after the 'remote' attribute

pfsense

• Log into the web-gui of pfSense
• Select VPN > OpenVPN and add an entry in the 'server' page
  Use the following settings:

Protocol: UDP
Local port: 1194
Address pool: 172.30.13.0/24 

(it should be a network that you DONT currently use)
Local Network: 172.30.10.0/24 

!!UPDATE: Note to add this value, you need to first save the setting and EDIT the settings again!!
Remote Network: blank
Cryptography: BF-CBC (128 bit) - or use what you want
Authentication Method: PKI

Now you need to have access to some of the files created in **c:\Program Files\openvpn\easy-rsa\keys** (mentioned in #12)
* Copy the WHOLE content of ca.crt into the "CA certificate" window
* Copy the WHOLE content of server.crt into the "Server Certificate" window
* Copy the WHOLE content of server.key into the "Server Key" window
* Copy the WHOLE content of dh1024.pem into the "DH parameters" window

• Tick DHCP-Opt: Disable NetBIOS (I dont use it anyway)
• Tick LZO Compression

— Now we need a few simple rules in the firewall —

• Go to Firewall > rules
• On the WAN interface you should make a rule that;

PASS

WAN
Protocol: UDP
source: any
OS type: any
Destination: any
Destination port range from: OpenVPN
Destination port range to: OpenVPN
Tick in the LOG
Leave the rest at default.

• and another rule on the interface called LAN

PASS
Any protocol
Source: LAN